Harry Sintonen

A buffer overflow exists in the Brotli decoder `c/dec/decode.c` due to a missing return value check. A remote unauthenticated attacker can exploit this by sending a specially crafted Brotli-compressed stream, which causes an invalid block switch that the decoder misinterprets as a request for more input. This leads to data being written beyond the limits of an internal eight-byte buffer, corrupting adjacent decoder state memory. This flaw, nicknamed Node2Shell or HTTP2Shell, can result in a denial of service, disclosure of sensitive memory contents, privilege escalation, or remote code execution. The issue affects various HTTP clients and servers that decompress Brotli data, including those in Node.js, Python, and .NET environments. Real-world scanning and exploit attempts have been observed.

An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the command-line interface (CLI).

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented, potentially allowing an attacker to perform a Man-in-the-middle attack.

Name of the Vulnerable Software and Affected Versions: cloud-init versions through 25.1.2 Description: The issue concerns the systemd socket unit `cloud-init-hotplugd.socket` in cloud-init, which has a default `SocketMode` that grants 0666 permissions, making it world-writable. This affects the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could potentially trigger hotplug-hook commands. Recommendations: For cloud-init versions through 25.1.2, consider restricting the permissions of the `cloud-init-hotplugd.socket` to prevent unauthorized access. As a temporary workaround, restrict access to the `/run/cloud-init/hook-hotplug-cmd` FIFO to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A key passphrase bypass is present in libssh when an agent is not set. This issue was discovered through analysis using curl. The potential impact is currently unknown. The vulnerability affects curl in Debian Linux.

The libssh software contains a flaw related to a global knownhost override. This issue could potentially allow an attacker to bypass host key verification, potentially leading to man-in-the-middle attacks. The issue involves the way libssh handles known hosts, allowing for a global override of host key checks.

Name of the Vulnerable Software and Affected Versions: curl versions 6.5 through 8.11.0 Description: The issue arises when curl is used with a `.netrc` file for credentials and follows HTTP redirects. Under certain circumstances, curl could leak the password used for the first host to the followed-to host. This flaw only manifests itself if the `.netrc` file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. Recommendations: For versions 6.5 through 8.11.0, upgrade to version 8.11.1 or later to mitigate the risk of credential leakage. As a temporary workaround, consider avoiding the use of `.netrc` files with curl or restricting access to sensitive information when following HTTP redirects.

A denial of service issue exists in the way libcurl provides several different backends for resolving host names. If libcurl is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. This can cause a multi-threaded application to crash or misbehave due to a global buffer that is not mutex protected. The issue can be exploited by a remote attacker to cause a denial of service.

A vulnerability in input validation exists in curl during communication using the TELNET protocol, which may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

An authentication bypass issue exists in the connection reuse feature of libcurl, affecting krb5/kerberos/negotiate/GSSAPI transfers. This is due to a failure to check for changes in the `CURLOPT GSSAPI DELEGATION` option, potentially resulting in unauthorized access to sensitive information. The issue allows previously established connections to be reused with incorrect user permissions.

A path traversal vulnerability exists in the SFTP implementation of curl, where the tilde (~) character is wrongly replaced when used as a prefix in the first path element. This flaw can be exploited by attackers to bypass filtering or execute arbitrary code by crafting a path like `/~2/foo` while accessing a server with a specific user. The vulnerability allows for the circumvention of filtering or worse.

The issue is related to an insecure umask configuration in Apache Airflow when running with the `--daemon` flag. This could lead to a race condition, resulting in world-writable files in the Airflow home directory. Local users could exploit this to expose arbitrary file contents via the webserver.

The issue is related to a insufficiently protected credentials vulnerability that may leak authentication or cookie header data on HTTP redirects to the same host but another port number. This could allow a remote attacker to incorrectly send the same set of headers to hosts that are identical to the first one but use a different port number or URL scheme. The vulnerability affects applications that pass on custom `Authorization:` or `Cookie:` headers, which often contain sensitive information.

The issue is related to the implementation of the configuration matching function in the curl utility, which does not properly handle IPv6 address zone IDs. This can lead to incorrect connections being made when one transfer uses a zone ID and a subsequent transfer uses a different (or no) zone ID. The vulnerability allows a remote attacker to potentially reuse a connection, leading to information disclosure.

The issue is related to the handling of HTTP(S) redirects during the authentication process in the cURL utility. When cURL follows redirects, it may leak credentials to other services on different protocols or port numbers. This could allow a remote attacker to gain unauthorized access to protected information. The problem arises because cURL's "same host check" is flawed, failing to consider cross-protocol redirects and different port numbers as separate hosts.

An issue in the firewall feature of the affected devices makes it easier for remote attackers to ascertain credentials and firewall rules. This is because the device returns different error codes for invalid credentials (error -2) and rule-based blocking (error -8), potentially allowing attackers to deduce the presence of specific rules or credentials.

An issue was discovered that makes it easier for attackers to conduct brute-force authentication attacks. The FTP and RTSP services do not have failed-authentication limits, unlike HTTP, which makes them more susceptible to such attacks.

An issue was discovered that allows unauthenticated persistent XSS through the ONVIF devicemgmt SetHostname method.

A remote stack-based buffer overflow issue was discovered, allowing attackers to conduct attacks via the `IPv4Address` field in the ONVIF devicemgmt `SetDNS` method.

An issue was discovered where the admin account has a blank password.